• (disco) in reply to accalia
    accalia:

    The custom handlers on keyboard and mouse events to prevent you from presssing keys such as "Ctrl+C"!

    /me runs away sobbing

    Even better (I really mean worse)...

    AT&T has custom handlers on some of their fields but ALLOWS Ctrl-C, -V, -X. BUT, they only allow CONTROL. They don't allow Command (⌘) on Macs. So, since I use a Mac, I can't paste in a user's cell phone number.

    Thank God for Greasemonkey. Snip out all references to the custom handler. Problem solved.

  • (disco)

    Wait until they find out about wget.

  • (disco)

    The correct way to work around this problem is to make a build of Chromium that has the inspector stripped out.

  • (disco) in reply to RaceProUK
    RaceProUK:
    some sites are just white pages until I turn scripting on?

    No, that seems to be more related to adblocking. In my experience, so far, most of them just have a "display : hidden" style on some tags that you can kill to get the content.

  • (disco) in reply to accalia
    accalia:
    because if i can get a whitescreen with noscript your framework is broken and it should feel bad.

    Or alternatively you need to get fitted for a :belt_onion: and go cave-shopping.

  • (disco) in reply to accalia
    accalia:
    can i borrow twenty quid for a standard claw hammer

    $28.65 — that's a rather expensive hammer, especially for its intended purpose. You can get a Husky 16 oz. Fiberglass [handle] Claw Hammer for $9.97 at Home Depot (or a 16 oz. Rip Claw Wood Handle Nail Hammer for only $5.88, but only online). $30-ish is about top-of-the-line for a claw hammer, unless you spring for a titanium head.

  • (disco) in reply to accalia
    accalia:
    sorry, but if you make your framework such that it cannot degrade gracefully in the absence of JS then i ain't touching it.

    ...you were expecting a client-side JavaScript framework to work at all when you disable JavaScript?

    Its full name is AngularJS for a reason. https://angularjs.org/img/AngularJS-large.png

  • (disco) in reply to powerlord

    I think the point is more that the site itself presents absolutely no content whatsoever when JS is disabled, which makes it look broken

  • (disco) in reply to powerlord
    powerlord:
    ...you were expecting a client-side JavaScript framework to work at all when you disable JavaScript?

    i was expecting the website to remain functional with JS disabled enabled, yes.

    angular obviously will fail to function, but the website should remain functional to some degree.

  • (disco)

    To avoid exposing code to users, further web development and testing involving Chrome was suspended company-wide.

    When a stupid rule of this magnitude is added, there is only one thing to do: enforce it. Take it to its natural conclusion.

    First, get management to ban Firefox too, on the same grounds. IE11 is now the only allowed browser.

    Wait some time. One day, mail them a VERY IMPORTANT SECURITY WARNING, and tell them you just discovered IE11 has hacking tools too. They are out of browsers now, but never fear! You already wrote a 10-page report on possible solutions: blocking them via group policy, downgrading to IE8, creating your own fork of Chromium with the developer tools removed...

    Its important that you treat the situation very seriously. Always reassure them that they are doing the right thing. This should lead them to trust you, since they are idiots who just seek reassurance for their own ideas.

    If you can get them to do any of those things, keep pushing: get them to ban clients from using Chrome, add obfuscation measures to the code, etc.

    What will happen is either they realize at some point how stupid it was and roll back, or they end up with a dysfunctional company that will go bankrupt in a year. It's win/win.

  • (disco) in reply to Quite
    Quite:
    When quantum mechanics was first proposed as a model for the universe at small scales, the question was asked: "How will we change the minds of all the old physicists to accept this new (indubitably more accurate) model?" The answer eventually came back: you can't. You just have to wait for them to die.

    I was told more generally, "Science progresses funeral by funeral."

  • (disco) in reply to anonymous234
    anonymous234:
    First, get management to ban Firefox too, on the same grounds. IE11 is now the only allowed browser.

    Don't all browsers have a 'view source' option in the right click menu? OHMYGODZ!$! We must stop the user from that too!!!! borrows @RaceProUK's hammer

  • (disco) in reply to dcon
    dcon:
    borrows @RaceProUK's hammer
    Would've preferred you to ask first :stuck_out_tongue:
  • (disco) in reply to RaceProUK
    RaceProUK:
    dcon:
    borrows @RaceProUK's hammer
    Would've preferred you to ask first :stuck_out_tongue:

    OOPS! may I, pretty please

  • (disco) in reply to Zemm
    Zemm:
    Company browser is now IE6. Any employee caught using anything else or installing web developer tools will be instantly terminated and handed over to the federal police for hacking and other computer crimes

    IE6 is a computer crime

  • (disco)

    If Charlie believes that testers have to test the tests, then who tests the testers?

  • (disco)

    Something I just realised: If you enter in a web address in any app that uses Windows' Standard File Open Dialog Box, it will use IE to open that address and return the resulting file (In Temporary Internet Files) to the program.

    So in other words, I can use Notepad to hack all the sites! [image]

  • (disco) in reply to dcon
    dcon:
    may I, pretty please
    Of course.

    Just bring it back clean, OK? ;)

  • (disco) in reply to RaceProUK

    [Physics|Philosophical] question time - can one dirty the blade of a lightsab[er|re]?

  • (disco) in reply to sloosecannon

    No; since the blade is pure energy, it cannot be dirtied.

    Next!

  • (disco) in reply to RaceProUK

    But what if you kill an innocent with it? Would it not be a dirtied weapon?

    Filed Under: Philosophical half of the question

  • (disco) in reply to sloosecannon

    Also, what if it was cortosis dust?

  • (disco) in reply to Dragnslcr
    Dragnslcr:
    PWolff:
    TRWTF is nobody of the C level asking a technician they trust (or even not knowing any technician they trust).
    They did. His name is Charlie.
    Exactly. They asked their lead tester, and he confirmed that it was a serious security issue. And they ignored the advice of all the other testers, because, after all, Charlie was the lead and he therefore knows better than the others.
  • (disco) in reply to TheDailyBread

    Not if you run SSL.

  • (disco) in reply to Captain

    Yes if you run Fiddler with HTTPS decryption enabled.

  • (disco) in reply to cheong

    dun dun dun

  • (disco) in reply to Captain

    Don't even need Fiddler, just use stunnel with telnet :stuck_out_tongue:

  • (disco) in reply to accalia

    Don't look at polymer or xtags by mozilla then.

    Angular is mean't for SPA applications. JS being on is the expected pre-requisite

  • (disco) in reply to accalia
    accalia:
    because if i can get a whitescreen with noscript your framework is broken and it should feel bad.

    Please don't anthropomorphise computers and attribute feelings to them. They really hate that.

  • (disco)
    No_1:
    Get one of these for less than a fiver and spend the change on cheap cider to limber up with before you start using it.

    yeah, that's about as much use as a glass hammer.

  • (disco) in reply to sloosecannon
    sloosecannon:
    But what if you kill an innocent with it? Would it not be a dirtied weapon?

    Filed Under: Philosophical half of the question

    Oh behave, or I'll take a holowhip to you.

  • (disco) in reply to sloosecannon
    sloosecannon:
    But what if you kill an innocent with it? Would it not be a dirtied weapon?
    Nope; just a dirty conscience.

    Next!

  • (disco) in reply to RaceProUK
    RaceProUK:
    Hmm... would that be why some sites are just white pages until I turn scripting on? If so, I have a little friend I want to introduce them to:

    And what on Earth does that have to do with custom markup?

    You can display ANY well-ish-formed XML markup in a modern browser and apply CSS to ANY well-ish-formed XML markup, too.

    The only thing that prevents a JS-handicapped browser from displaying the content that's loaded with JS is the fact that it's loaded with JS and the browser's JS-handicapped. Would have happened with custom markup, would have happened with usual HTML markup.

  • (disco) in reply to emkael
    emkael:
    And what on Earth does that have to do with custom markup?
    Have you actually read anything in this thread, or did you just froth at the mouth so much you rushed right in and spouted crap without thinking?
  • (disco) in reply to RaceProUK

    Yes, and it contained 30% memes, 30% circlejerking, 30% unprovoked Angular bashing and 10% discussion on "encrypting" pages with custom markup which started the other 90%.

  • (disco) in reply to emkael

    And your point is? Or are you just upset someone doesn't like your 'special' JS framework?

  • (disco) in reply to Tsaukpaetra

    But that is a function of the Windows OS not an individual program. So the only logical conclusion is to ban Windows.

  • (disco) in reply to RaceProUK

    My point had nothing to do with Angular and was laid out two posts ago and by hungrier in post 44: that <fancy-custom-tag /> is not enough to make a page turn "whitescreen", which was the foundation of your rant afterwards.

    I'm sorry if that's upsetting, I'll do my best and try to sprinkle my point with some GIFs next time around.

  • (disco) in reply to emkael

    So your point is that someone who won't spend five minutes checking a site degrades properly with JS off will spend two days reimplementing HTML in CSS.

    Yeah, not buying it.

  • (disco) in reply to emkael
    emkael:
    30% memes, 30% circlejerking

    http://i.imgur.com/rcNrT.gif

  • (disco) in reply to dkf

    we need a circlejerking meme so we can screw with those statistics

  • (disco) in reply to lucas
    lucas:
    JS being on is the expected pre-requisite

    :anger:

    no website should require JS to be enabled for browsing the site.

    I'm willing to have degraded experience (no fancy popups or ajax content loaded without JS, but the browsing functionality should still be there.) and i'm even willing to be locked out of active interactions (no JS = readonly) if that's absolutely "required", but that's it.

    the sight must remain accessible to users without JS.

    for one thing Google's spiders certainly don't use JS and they need to crawl your site, if google can't crawl your site ain't nobody gonna find your site.

  • (disco) in reply to accalia
    accalia:
    for one thing Google's spiders certainly don't use JS
    Actually, [that changed fairly recently](https://googlewebmastercentral.blogspot.co.uk/2015/10/deprecating-our-ajax-crawling-scheme.html): >Times have changed. Today, as long as you're not blocking Googlebot from crawling your JavaScript or CSS files, we are generally able to render and understand your web pages like modern browsers.

    Of course, that doesn't negate the need to have graceful degradation, but it does make it less of an SEO issue and more of a UX issue.

    Edit: Also, I must make this clear, this only applies to Google; there's no guarantee other spiders will do the same thing.

  • (disco) in reply to RaceProUK
    RaceProUK:
    dcon:
    borrows @RaceProUK's hammer
    Would've preferred you to ask first :stuck_out_tongue:

    Any of you can use my thakking stick. Don't bother cleaning it afterwards. Viscera add patina.

    [image]
  • (disco)
    ixvedeusi:
    Is it really that difficult to create an online applications platform which is actually designed for this use and provides a reasonable environment for it?
    Nope. What's difficult is generating a critical mass of users. Every mainstream OS comes with a builtin web browser these days, each with a functioning Javascript engine, so that's what you're competing against.
  • (disco) in reply to emkael
    emkael:
    it contained 30% memes, 30% circlejerking

    Welcome to The Internet. Enjoy your stay.

  • (disco) in reply to accalia
    accalia:
    the insertion of "span" tags around EVERYTHING!

    That's not obfuscation, that BAU. Last I checked, spamming the code with span tags was a common fault in a lot of current HTML code-generation tools, just like inserting tons of non-breaking spaces and shim images used to be (and still is for some of them). A bunch of WYSIWYG editors did it, as did some server-side frameworks. Dunno if that's been fixed on any of them or not.

  • (disco) in reply to jkshapiro
    jkshapiro:
    Every mainstream OS comes with a builtin web browser these days, each with a functioning Javascript engine, so that's what you're competing against.

    Yes, but that competition is crap.

    Yes, apparently it is possible to build useful, friendly and feature-rich applications in web browsers (mostly because we have frameworks upon frameworks which try to hide away the worst of the crap), but I would expect a well-designed system for doing so to be so much friendlier for both the developers and the end-users that it should be able to beat that competition to dust in short notice.

    I think right now it's mostly a problem with software Stockholm Syndrome, where so much investment has been made, so much knowledge has been accumulated, and so many tools have been (and continue to be) developed to make the crappy platform more or less viable, that everyone just accepts this state as "how it is" and nobody seriously considers any alternatives any more.

  • (disco)

    You didn't know? That's always been how they move!

  • (disco)
    anotherusername:
    :whoosh:

    YIP YIP KYON BARK GROWL YIP BARK BARK KYON

    -BITE-

Leave a comment on “Website Hacker”

Log In or post as a guest

Replying to comment #:

Log Out

« Return to Article